ISIS Will Leverage Improved Attack Capabilities to Generate Forces in Syria

Turkish military activity in Syria will accelerate the strengthening of the Islamic State in Iraq and al Sham. The Syrian Democratic Forces (SDF) announced on November 23 that it would stop counter-ISIS operations in northeastern Syria so that it could address the Turkish threat, decreasing counterterrorism pressure on ISIS. ISIS is gradually increasing its attack capabilities in northeastern Syria and will use these capabilities to continue freeing imprisoned members and absorbing expertise and personnel in preparation for a larger resurgence. The group will attempt to exploit weaknesses in US-supported SDF counterinsurgency efforts to create sanctuaries. ISIS will use new sanctuaries to mount larger and more sophisticated attacks to degrade the SDF.

The Islamic State in Iraq and al Sham is increasing its attack capabilities in northeastern Syria. ISIS has increased its use of vehicle-borne improvised explosive devices (VBIEDs), a capability that requires robust logistics. ISIS’s VBIED use surged during two recent periods, indicating that the group’s attack capabilities are strengthening. The first surge occurred between September 2021 and January 2022. ISIS used five VBIEDs—two of them successful—during this period. The first surge also points to an increase in capability compared to early 2021, when ISIS only mounted motorcycle-borne improvised explosive device (MBIED) attacks in northeast Syria. The second surge occurred in September 2022. ISIS built at least *four VBIEDs and one MBIED—employing *one VBIED and *one MBIED successfully—during the second surge. The group’s ability to construct a similar number of VBIEDs in a shorter time frame indicates a capability increase compared to the first surge.

ISIS likely used freed fighters and redeployed some preexisting cells to conduct its VBIED surges. ISIS moved fighters from the Syrian desert back to Iraq and northeastern Syria in 2021, contributing to the first VBIED surge in September 2021. ISIS’s January 2022 al Sina’a prison attack freed at least 300 fighters. This prison break likely increased organizational capacity, allowing ISIS to begin a second VBIED surge in September 2022. ISIS also appointed a new Iraqi-born emir in the central Syrian desert in 2022 who was freed during the al Sina’a prison break. The need to reintegrate freed fighters into ISIS’s organizational structure in northeastern Syria may explain the time lag between the prison break and the September VBIED surge. ISIS will continue its effort to free sympathizers and fighters. The group’s attack attempt against al Hol internally displaced people (IDP) camp in September 2022 likely sought to free cells and sympathizers, though a successful attack would also have propaganda value by freeing ISIS families and protecting women.

Figure 1. ISIS VBIED Surges, 2021–22

Source: Brian Carter.

ISIS’s predecessor, al Qaeda in Iraq (AQI), used VBIED capabilities to free imprisoned fighters and improve the quality of its attack cells. AQI prison breaks in 2012 strengthened the group’s capabilities in Iraq. AQI prison breaks likely led to its ability to conduct major VBIED “waves” targeting Iraqi population centers in 2012–13. ISIS today is weaker than AQI was in 2012–13, but ISIS is likely using prison breaks to resuscitate some capabilities. Recent prison breaks and smaller escapes likely improve ISIS’s capabilities by providing experienced fighters for the group.

Syria in 2022 is less permissive for ISIS than Iraq was in 2011–13. AQI was capable of repeated spectacular attacks targeting civilians in Iraqi cities. AQI used 30 VBIEDs on one day in July 2012, a number far beyond ISIS’s current capabilities in Syria. ISIS does not have the freedom of movement or access to funding required to conduct VBIED attacks at AQI’s 2012–13 rate. ISIS also does not have the same organizational capacity AQI had in 2013. AQI had “reconstituted as a military force” with a “force-level planning cell” that could “task VBIEDs to support a complex, specialized operation” by 2013, while ISIS is a “low-level insurgency” in 2022. There is also greater counterterrorism pressure on ISIS in 2022 compared to that on AQI in 2011–13. The SDF receives greater US support than did Iraq during 2011–13, and the SDF may be more effective than the Iraqi Security Forces were between 2011–13. US special operations forces and air support limited the ISIS prison break at al Sina’a in January 2022. Tribes continue to facilitate US and SDF counterterrorism operations by providing intelligence, despite the risks posed to them by ISIS.

ISIS will likely pursue a similar strategy to the one that enabled its predecessor’s resurgence in Iraq in 2011, despite a less permissive environment in Syria today. ISIS is at a very early stage in its resurgence, and it will likely pursue its strategy at a slower rate than AQI did after 2008. AQI sowed division between the government and local population in Sunni areas of Iraq in 2011–13 by *targeting tribal “awakening” fighters who successfully rolled back Iraqi counterterrorism gains against al Qaeda in Iraq between 2007 and 2011. ISIS is emulating this effort by attempting to turn SDF-controlled territory into “areas of fear and terror” by assassinating members of the SDF and its allies “at will” to create panic. ISIS is also using Syria’s desert as a sanctuary where it can rebuild its capabilities, similar to AQI use of rural areas in Iraq after 2008.

ISIS’s increased logistical and operational capacity will allow it to intensify its efforts to target detention facilities. ISIS’s *IED manufacturing sites and major weapons depots ISIS possesses a logistical apparatus that will allow it to conduct further attacks against detention facilities or other high-value targets. ISIS is likely also capable of generating intelligence using SDF and local informants to facilitate attacks and prison breaks. The SDF’s capture of a *major weapons depot near Tel Hamis in September 2022 could temporarily stop some attacks, but VBIED attacks are likely to resume unless the SDF arrests the VBIED cell and its more permanent assets, such as manufacturing facilities.

The SDF’s counter-ISIS operations and new security measures around detention facilities have not removed the threat ISIS poses to these facilities. The SDF’s failure to secure areas surrounding prisons in northeastern Syria will allow ISIS to continue attack attempts aimed at freeing prisoners. The SDF did move “approximately half” of ISIS detainees to “more secure facilities.” The Defense Intelligence Agency, however, reported in May 2022 that many of the same vulnerabilities that enabled the January 2022 al Sina’a prison attack persist at the prison. ISIS *VBIED and *sleeper cells likely remain active near major detention sites, such as *al Hol IDP Camp and *al Sina’a *prison. ISIS used sleeper cells and VBIEDs staged nearby to conduct the al Sina’a attack in January 2022. These cells fixed SDF forces in place and prevented SDF units from responding to the al Sina’a attack, increasing the ability of ISIS fighters to escape. In Raqqa, ISIS sleeper cells are likely intentionally “lying low” to avoid US and SDF pressure. The group *attempted two prison breaks in Raqqa in fall 2022, and it could use sleeper cells to launch future attempts.

The SDF will prioritize confronting Turkish military activity over counter-ISIS operations. Turkey is targeting the SDF with air strikes and threatening a ground incursion in northern Syria. Another Turkish incursion will distract the SDF and cause the SDF to decrease its counterterrorism pressure on ISIS. The SDF’s spokesperson said the group could not deter Turkish attacks and fight ISIS simultaneously and stopped counter-ISIS operations on November 23, though the SDF resumed joint patrols with US forces on December 2. Lifting SDF counterterrorism pressure will provide an opening for ISIS to prepare attacks against key facilities, such as al Hol IDP camp. A Turkish air strike on November 23 near al Hol targeted an SDF base. The air strike did not target al Hol itself, but air strikes against SDF security near al Hol distracts SDF forces tasked with securing al Hol’s surroundings. This could allow ISIS to exploit opportunities to target high-value facilities such as al Hol or other prisons in northeastern Syria.

Even without a significant Turkish incursion, ISIS will take advantage of the SDF’s counterproductive counterterrorism approach. The current SDF approach relies on *mass arrests, *counterterrorism *raids, and destruction of property. These tactics contribute to popular grievances, which are key to a renewed insurgency. ISIS can recruit through detention centers after mass arrests and encourage retaliation against the SDF for counterterrorism raids and property destruction. ISIS is often able to maintain its presence in areas subject to SDF raids and arrests. ISIS reportedly “owns the night” in areas of northeast Syria and threatens to kill SDF employees for their cooperation with the SDF. The SDF’s approach actively worsens core grievances among the local communities, such as reconstruction and a lack of services.

ISIS could undermine the SDF by sowing division between Arab communities and the SDF in northeastern Syria. The group will aim to expand from desert sanctuaries and attempt to create support zones by assassinating and *intimidating SDF civilian and military employees, *tribal dignitaries, and other local civilians.[1] The SDF’s counterterrorism approach is overly reliant on mass arrests, while its fails to *protect its employees and *civilian populations. These shortcomings could drive local communities to support ISIS and provide sanctuary to the group. Poor security and governance already created tension between the SDF and local communities in 2020.

Figure 2. ISIS Intimidation and Executions North of the Euphrates River, from September 1 to December 1, 2022

Source: Brian Carter.

Division between the SDF and locals will allow ISIS to use its presence in northeastern Syria to limit the SDF’s freedom of movement and gradually reimpose its governance in areas of northeastern Syria. ISIS has successfully fixed the SDF in place during certain operations, such as the al Sina’a prison break. Increased ISIS capabilities could make a similar effort more successful in the future. Fixing the SDF in place or isolating specific bases could cause the SDF to vacate some areas if SDF reinforcements cannot protect outposts or smaller bases in ISIS attack zones. SDF bases and outposts allow the SDF to protect the surrounding areas. The SDF may also become less capable of targeting ISIS cells as local communities lose faith in the SDF’s security. Local activists in Deir Ezzor said SDF raids sometimes target innocent civilians due to faulty intelligence. Decreased SDF presence and capability would allow ISIS to reimpose its governance gradually in some areas.

ISIS could strengthen quickly should conditions change, causing Syria to become more permissive for ISIS. The SDF remains reliant on US intelligence support to enable operations, though SDF intelligence collection and exploitation is improving. A US withdrawal could decrease the SDF’s effectiveness by ending US intelligence and logistical support. ISIS could use decreased pressure to strengthen capabilities such as VBIED manufacturing and local recruitment. These capabilities would allow ISIS to mount sophisticated attacks against SDF military positions and detention sites. ISIS is capable of generating funds through smuggling and forced zakat collection. The group could expand these efforts further if competing priorities distract the SDF. Finally, increased ISIS intelligence collection and exploitation may allow ISIS to assassinate and intimidate local leaders to cooperate with ISIS, to the detriment of the SDF.

The death of ISIS’s leader in mid-October is unlikely to change ISIS’s trajectory in northeastern Syria. Local Syrian armed groups killed ISIS’s leader in southern Syria on October 17. The al Sina’a prison break in January 2022 was likely the last major operation planned by ISIS’s overall leader. ISIS’s emir in northeastern Syria likely has both the authority and resources required to plan and conduct complex attacks against high-value targets in northeastern Syria. An Iraqi militant freed from al Sina’a in January 2022 leads ISIS in the central Syrian desert. His time in al Sina’a indicates he may have significant experience within ISIS before 2019 and may be able to assist planning efforts. ISIS cells in the central Syrian desert likely support ISIS activity in northeastern Syria.